Yes. I was hoping to fix the # in the shipaddress, then look into these other areas of concern in the future. I don't want to start too many things at once. Could you suggest how I should use the escape function in my code?
Well...you don't say what you found (it would really help if you didn't assume we had telepathy...), but let's pretend it was urlEncodedFormat() you discovered. Because that'd be the right function to use ;-)
So... having discovered that, have you read the docs for it? http://help.adobe.com/en_US/ColdFusion/9.0/CFMLRef/WSc3ff6d0ea77859461172e0811cbec22c24-7bdf.html
Have you just googled it to see any other examples in use?
Do you understand how CF functions work / are used (this might seem like a stupid question, but the wording of your post earlier makes me unsure... but ti could just be the wording... or my reading thereof).
Basically if you have a value in a URL which contains characters that are meaningful to the URL (like &, =, %, #, etc), you need to use urlEncodedFormat to convert the characters into a URL-safe encoded representation of them.
So if you had this value "here's a # sign" that you wanted to put in a URL, you'd need to use urlEncodedFormat() to escape it:
http://yourdomain.com/path/to/file.cm?param=#urlEncodedFormat("here's a # sign")#
Basically anything user-entered needs to be escaped, because you cannot predict what a user will enter...
--
Adam